Low-dimensional quite noisy bound entanglement with cryptographic key 
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We provide a class of bound entangled states that have positive distillable secure key rate. The 
smallest state of this kind is 4 <g> 4. Our class is a generalization of the class presented in [J. It is 
much wider, containing, in particular, states from the boundary of PPT entangled states (all of the 
states in the class in |l| were of this kind) but also states inside the set of PPT entangled states, 
even, approaching the separable states. This generalization comes with a price: for the wider class a 
positive key rate requires, in general, apart from the one-way Devetak- Winter protocol (used in [l|) 
also the recurrence preprocessing and thus effectively is a two-way protocol. We also analyze the 
amount of noise that can be admixtured to the states of our class without losing key distillability 
property which may be crucial for experimental realization. The wider class contains key-distillable 
states with higher entropy (up to 3.524, as opposed to 2.564 for the class in [l|). 
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I. INTRODUCTION 

Quantum cryptography, pioneered by Wiesner Q, al- 
lows to obtain cryptographic key based on physical im- 
possibility of eavesdropping. Namely, if the transmitted 
signal is encoded into quantum states, then by reading 
it, eavesdropper always introduces noise into the signal. 
Thus Alice and Bob - the parties who want to communi- 
cate privately - can measure the level of noise and detect 
whether their transmission is secure (even if the noise 
was solely due to eavesdropping). There are two types of 
quantum key distribution protocols: prepare and measure 
(as the original BB84 protocol [3() and protocols based 
on a shared entangled state (originated from the Ekert's 
protocol 0|). For quite a time security proofs of pre- 
pare and measure protocols had been based on showing 
equivalence to the distillation (by local operations and 
classical communication) of maximally entangled states 
(the first such proof is due to Shor and Preskill [5]). It 
have led to a belief that security of the quantum cryp- 
tography is always connected to the distillation of the 
maximally entangled states (this issue was perhaps first 
touched by Gisin and Wolf Q). 

This belief suggested that one could not obtain secure 
key from bound entangled states Q, i.e., states from 
which maximally entangled states cannot be distilled. On 
the contrary, the key-distillable bound entangled states 
have been found [8j and examples of low dimensional 
states have been provided The multipartite case was 
also considered [9j. There are two approaches to obtain- 
ing cryptographic key from bound entangled PPT states: 
one is based on approximating private bit with a PPT 
state [H, [l(| and the other one - on mixing orthogonal 
private bits 

This paper continues on the second approach. The 
low dimensional key-distillable states with positive par- 
tial transpose [3lJ (hence, bound entangled) presented in 
[l| were lying on the boundary of PPT states and ex- 
istence of the key-distillable states inside of PPT states 
was argued by the continuity argument, without giving 
the explicit form of those inner states. In this paper we 



present a wider class of PPT entangled key-distillable 
states including states inside the set of PPT states even 
approaching the set of separable states. We analyze prop- 
erties of this class, as well as provide some more general 
criteria of key distillability, by exploiting criterion pro- 
vided in (Tlj . This criterion was earlier applied to analyze 
some PPT states in [12| (see also [13j in this context). 

The motivation behind the search for new bound en- 
tangled states with distillable key, is two-fold. First of 
all, there is a fundamental open question, whether from 
all entangled states one can draw secure key. To ap- 
proach this question, one needs, in particular, to gather 
more phenomenology on the issue of drawing key from 
bound entangled states. In this paper, we have pushed 
this question a bit by showing explicitly that PPT key- 
distillable states can be in the interior of PPT states, 
even, approaching the set of separable states. Also, our 
general criterion of key distillability can serve for search- 
ing to what extent entanglement can provide for secure 
key. 

Another motivation comes from recent experiments, 
where bound entanglement was implemented in labs fl4l - 
Il8| . In the experiments, usually, a four-partite bound en- 
tangled Smolin state was used, which allows for a num- 
ber of non-classical effects being manifestations of true 
entanglement content of such state. We believe that low- 
dimensional bound entangled key-distillable states are 
also good candidates for experimental implementation, 
providing a non-classical effect - possibility of distilling 
secure key. This requires states which are robust against 
noise, to facilitate the process of preparing them in a lab. 
In this paper, we analyze robustness of key-distillable 
states as well as provide very noisy states, having, in 
particular, relatively large entropy (c.a. 3.5 bits versus 4 
bits of maximal possible entropy). Last but not least, the 
key-distillable bound entangled states are strictly related 
to the effect of superactivation of quantum capacity [l9| , 
and our class may be further analyzed in this respect (in 
this paper, we have provided some exemplary calcula- 
tions). 

The paper is organized as follows. In Sec.|TI]we review 
basic facts about general theory of distillation of secure 
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key from quantum states of [lPf . In particular, we de- 
scribe technique called the privacy squeezing. In Sec. IIIII 
we introduce our class of states which are PPT and key- 
distillable. We verify that they lie inside the set of PPT 
states, touching the set of separable states. Moreover, 
we check robustness of the property of key-distillability. 
We also give the explicit form of an important subset 
of our states as mixtures of pure states in Sec. IIV[) . In 
Sees. [V] and IVII we examine entropic properties of our 
states and their relation with Smith- Yard superactiva- 
tion of quantum capacity phenomenon. Finally, in Sec. 
IVII1 we provide a general sufficient condition for distill- 
ing private key from quantum states of local dimension 
not less than 4. 



II. PRELIMINARIES 

Let us first recall some important concepts of classical 
key distillation from quantum states, covered in detail in 

m 

A general state containing at least one bit of perfectly 
secure key is called the private bit or pbit [10]. A private 
bit in its so-called A-form is given by 
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where A is an arbitrary operator satisfying ||A|| = 1 
(here and throughout the paper, we use the trace norm, 
that is the sum of the singular values of an operator). The 
private bit has four subsystems: ABA 1 B' where block 
matrix JT]) represents AB subsystem and the blocks are 
operators acting on an A'B' subsystem. Subsystems A 
and B are single qubit subsystems while dimensions of 
A' and B' must be greater or equal to 2, we assume di- 
mensions A' and B' are equal and denote them by d. 
Subsystem AA 1 belongs to Alice while subsystem BB' 
belongs to Bob. Every state presented in the block ma- 
trix form throughout the paper has this structure. The 
bit of key contained in a private bit is obtained by mea- 
suring subsystems A and B in the standard basis; there- 
fore, subsystem AB is called the key part of the state, 
while subsystem A'B' is called the shield of the state, as 
it protects correlations contained in the key part from an 
eavesdropper. Note that it may happen that Eve pos- 
sesses a copy of the shield subsystem (when, e.g., the 
shield consists of two flag states - states with disjoint 
support) yet it does not hurt because the very presence 
of the shield subsystem in Alice and Bob's hands protects 
the bit of key. 

For a general state with ABA' B' subsystems (i.e., not 
necessarily a private bit) one can infer possibility of dis- 
tillation of private key using the method called the pri- 
vacy squeezing [k}. Namely, we consider the following 
type of protocols: one measures the key part in the stan- 
dard basis and classically process the outcomes (cf. [ll| 



for two-qubit states). Given a protocol of this type we 
would like to know whether it can distill key from the 
state. To this end, we construct a two qubit state in the 
following way: one applies to the original state the so- 
called twisting operation, i.e., a unitary transformation 
of the following form 



U =J2\ij)AB{ij\®U ) 



A'B' 
ij 



(2) 



and perform partial trace over A'B' . Now, it turns out 
that if we apply the protocol to the original state we 
obtain no less key than we would obtain from the above 
two qubit state using the same protocol. 

Therefore, if we apply a cleverly chosen twisting, we 
may infer key-distillability of the original state, by ex- 
amining a two-qubit state (i.e., a much simpler object). 
This technique is called the privacy squeezing. The role of 
twisting is to 'squeeze' the privacy present in the original 
state into its key part, where it is then more easily de- 
tectable, e.g., by protocols designed for two-qubit states 
(see e.g., 0, 0, E|). 

To explain why the two qubit state cannot give more 
key than the original state (within the considered class 
of protocols) we invoke the following result of [10]. One 
considers a state of three systems: a quantum one - Eve's 
system and two classical ones - the registers holding the 
outcomes of measurement of the key part (the state is 
therefore called a ccq state). Now, it turns out that twist- 
ing does not change this state. However, in the consid- 
ered class of protocols Alice and Bob use only classical 
registers, so the output of such protocols depends solely 
on the ccq state. Thus the key obtained with and with- 
out twisting is exactly the same. This holds, even though 
twisting is a non-local operation and the resulting state 
can be more powerful under all other respects (such as 
drawing key by some other type of protocols). Next, if 
we additionally trace out the shield, i.e., the subsystem 
A'B' , this means that the resulting ccq state differs from 
the original ccq state only by Eve having, in addition, 
the shield. Thus, if any key can be obtained from it, it 
can only be less secure than the key obtained from the 
original ccq state. 

It turns out that for any 'spider' state, i.e., state of the 
form 



Q = 



C D 
E F 
E' 

£>t C" 



(3) 



(where we have omitted zero blocks for clarity) there ex- 
ists such a twisting operation that the matrix elements 
of the two qubit state, obtained by tracing out the A'B' 
subsystem after applying the twisting, are equal to trace 
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"(Ai + A 2 )VXXT (Ai-A 2 )X ' 

1 (A 3 + A 4 )VFFt (A 3 - A 4 )F 

2 (A 3 -A 4 )F t (Xs + X^s/yW 

. (Ai-A 2 )X t (Ai + A 2 )^XtX. 

FIG. 1: Block matrix form of mixture of four private bits. 



norms of the corresponding blocks in the original state: 
|C|| ^ m ^ WDW^ 

(5) 



\E\\ 11*11 
\F\\ \\E'\ 



\D\\ 



\C'\ 



(we use here that \\A\\ = \\A^\\ for trace norm). This 
twisting is in a sense optimal for the spider states. We 
call the two qubit state (O the privacy-squeezed state of 
the original state. If a spider state satisfies ||C|| = ||C"|| 
and \\E\\ = \\E'\\ than its privacy-squeezed state is a Bell 
diagonal state. 

For a deeper discussion of the privacy squeezing see 
although the name spider state is not used there. 



III. DISTILLING KEY FROM PPT MIXTURES 
OF PRIVATE STATES 

Here, we construct a class of bound entangled states 
which are key-distillable. They are mixtures of four or- 
thogonal private bits of some special form. We provide a 
sufficient condition to distill cryptographic key from our 
class. The condition given in this section is generalized 
to an arbitrary state in Sec. IVIII 



Definition of the class 



Let us consider a class of states 

g = XiJi + A 2 7f + A 3 7^ + X^ 



(6) 



which is a mixture of four orthogonal private bits which 
could be considered analogues to the Bell states. The 
construction is possible in dimension 2d® 2d, with d > 2. 
The four private bits are given by 



7l t = 7 (±X), 



it 



(7) 



where is a Pauli matrix o~ x applied on subsystem A, 
and by j(X) we mean a private bit written in its X-form 

States given by © and (JJJ have the block matrix form 
§4§ given on figure [TJ 

Definition 1. We define the class C as the class of states 
given by © and (Q with operators X and Y related by 



Y = 



X 1 



\X r \ 



(8) 



where superscript T denotes the partial transposition in 
Alice versus Bob cut; and satisfying the following condi- 
tions: the diagonal blocks of i.e., operators \X)0 , 
VxTx, VyyT, VyW are all PPT-invariant, i.e., must 
satisfy A = A r . 

(The relation ([5]) and PPT-invariance of the diagonal 
blocks are necessary to obtain simple conditions for the 
state to be PPT, given in Sec. lHTB) . 

In particular, the PPT-invariance of the diagonal 
blocks holds for 



I J- 1 



(9) 



i,j=0 



where elements of some unitary matrix onC d and 



d-l 

u= \ u ij\- 
For the operator X given by @ we have 



(10) 



u Vd 



\X L II < 1 



(11) 



where the minimum is achieved for the unimodular uni- 
tary [l[ and maximum for the identity matrix. 

We will sometimes write qjj to denote the subclass of 
the class C with operator X given by Q or to stress using 
a concrete unitary in the definition of X, in particular, 
we will consider the subclass qh where u^j Eire elements 
of the Hadamard unitary matrix. 

In case of d = 2 we will also consider the subclass of 
the class C with operators X and Y given by 



Y = qY Ul + (l-q)a^Y U2 ai 



X 



Y 1 



\Y r \ 



where 



. d-l 



(12) 



(13) 



i,j=0 



Unitaries U± and U2 must have the same global phase, 
i.e., ot\ — a.2 in the parametrization of a single qubit 
unitary given by (|72p in the appendix. In particular, one 
may take U\ = U%. 
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We also use an alternative parametrization in terms of 
p, a, and j5 given by 



p= Ai +A 2 e [0,1] 
_ Ai — A 2 



(3 = 



Ai + A 2 
A3 — A4 
A3 + A4 



e[-i,l] 
e[-i,l]. 



(14) 
(15) 

(16) 



On the other hand, the original parameters Ai can be 
expressed using p, a, and /3 as follows: 



Al,2 
A3, 4 



l±a 
2 

l±/3 



P 

(i-jO- 



(17) 
(18) 



Both parametrizations are directly related with the 
privacy-squeezed version of the state given by C and Q , 
and constructed according to the formula ([5]): 



E 



p ap~ 
(1-p) 0(1- p) 
P(l-p) (l-p) 



ap 



(19) 



where the Bell states ipi are given by 

1 



1-01,2) 
1^3,4) 



V2 
1 

71 



(|00) ± |11)) 
(|01) ±|10)). 



Thus, Ai are the eigenvalues of the privacy-squeezed 
state, p reports the balance between correlations and 
anti-correlations, while a and (3 report how coherences 
are damped. 

A subclass of the class C with X defined by © has 
been considered in fijl: 



Q = A17+ + A37+. 



(21) 



The class C is much wider then ([2"TT) . in particular, it 
contains key-distillable PPT states arbitrary close to the 
separable states, but this comes with a price: we have 
to, in general, use the recurrence preprocessing to obtain 
positive key rate for C while for (|2ip the sole Devetak- 
Winter protocol is enough [lj|. 



B. Sufficient PPT conditions 

For the states of the class C to be PPT (so that max- 
imal entanglement cannot be distilled from them) it is 
sufficient to satisfy the following conditions 



|Ai-A 2 |<(l-A 1 -A 2 )||X r | 
|A 3 -A 4 | < (A 1 + A 2 )||X r || 



(22) 
(23) 



or equivalently 

\a\ < min(l, oil) 
\0\ < min(l,a l ; 1 ) 

where 



a 1 = ^— V r ||-\ 
P 



(24) 
(25) 

(26) 



In particular, if p = Ai where Ai is given by (|27p . we have 
ai = !• Moreover, if a — a±/3 then g is a PPT-invariant 
state. 

For the subclass (|2"T1) . the above PPT conditions col- 
lapse to a single PPT-invariant state, on the boundary 
of PPT states, which satisfies 



Ai =Ai = 



1 



l + ll^ r l 



(27) 



C. Key distillability 



We shall derive here a general sufficient condition for 
key-distillability of the spider states with a Bell diagonal 
privacy-squeezed state, which easily follows from combin- 
ing the privacy squeezing technique with the result of (TT| 
on key distillation from two-qubit states. It is enough for 
our purposes, as states of our class are of that form. (In 
Sec. IVIII we shall extend the key-distillability condition 
to arbitrary states by exploiting twirling). 



(20) Proposition 1. Let g be a state of the form 



C D 
E F 
Ft E' 

Dt a 



(28) 



satisfying \\C\\ = \\C'\\ and \\E\\ = \\E'\\, i.e., g is a state 
having a Bell diagonal privacy-squeezed state. If 



m^{\\DU\F\\)> ^CW\ 



(29) 



then Alice and Bob can distill cryptographic key by first 
measuring the key part of many conies of the state g 
and than using the recurrence J23i , \23i] and the Devetak- 
Winter protocol f22] . 

Remark 1. Note that, interestingly, the condition (|2"9"|) 



(30) 



is not a positive one. 

Remark 2. Note that the right-hand side of Eq. 
also be written as \ y/p e (l — p e ) where p e is the probabil- 
ity of error (i.e. anticorrelation) when key part is mea- 
sured in standard basis. 



is equivalent to requiring that 


one 


of the matrices 




"IICII \\D\\ 




'\\c\ 


\\F\\ 






\\dH \\e\\ 


) 


J|Ft 


\\E\\_ 
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Proof of the proposition [7J We apply the privacy squeez- 
ing technique described in Sec. UH i.e., we show that the 
privacy-squeezed state of g is key-distillable by a proto- 
col based on measuring the state locally in the standard 
basis and classical postprocessing. This implies g is also 
key-distillable. 

The privacy-squeezed state is precisely of the form ([5]) 
with \\C\\ = \\C'\\ and ||£|| = \\E'\\, i.e., it is a Bell diag- 
onal state which can be written as 



1 

a= 2 



a d~ 

e / 
/ e 
d a 



(31) 



For such a state it was shown in [ll| that if max(|d|, |/|) > 
y/ae then one can distill key by measuring the state lo- 
cally in the standard basis, and processing the resulting 
classical data (actually, by using the recurrence followed 
by the Devetak- Winter protocol). This is precisely the 
type of protocols allowed by the privacy-squeezing tech- 
nique described in Sec. [XXJ In our case, the above condi- 
tions are simply the ones given in (j2"5)) . □ 

Due to the form (fT§|) of the privacy-squeezed state of 
the states from our class, we immediately obtain suitable 
conditions: 

Corollary 1. Let g be a state defined by formulas C and 
([7]) with arbitrary X and Y satisfying \\X\\ = \\Y\\ = 1. 
If 



|Ai-A 2 | > a/(Ai+A 2 )(1-Ai-A 2 ) (32) 
or equivalently if 



a > 



1-p 



P 



(33) 



then Alice and Bob can distill cryptographic key by first 
measuring the key part of many copies of the state g and 
than using the recurrence and the Devetak- Winter proto- 
col. 

Corollary [1] also holds if one uses | A3 — A4 1 as the left- 
hand side of (|32[) or equivalently \j3\ as the left-hand side 
of (|33p . however, in our paper, we do not use these con- 
ditions. 

Observation 1. For a state of the class C to be both 
PPT and key distillable using corollary [7] it must satisfy 
both (|24|l and (|33p . For a given value of the parameter p 
there exist a satisfying both conditions iff p £ (|,J) m ax) 
where 



1 



Pmax — 



\x r \ 



(34) 



0.25 



region of 
PPT key . 



0.5 



0.6 



A, 



Recurrence and Devetak- Winter tolerable noise 

Devetak- Winter tolerable noise 

White noise needed to make states PPT 



FIG. 2: Comparison of qh tolerable noise in case of using 
the Devetak- Winter protocol with and without the recurrence 
preprocessing. 



D. Tolerable white noise 

We say that 5 is the tolerable noise of a key distillation 
protocol for a state g if for any e < 8 the state g e with e 
of the white noise admixtured 



Qe = (l-s)g + s 



d 2 



(35) 



remains key-distillable with that protocol. 

Having p > |, the tolerable noise of the Devetak- 
Winter protocol with the recurrence preprocessing for the 
class C is given by 



5 = 1- 

= 1 



1 



y/8(\j + A|) - 4(Ai + A 2 ) + 1 
1 

^4(1 + a 2 ) p 2 - 4p+ l' 



(36) 



(37) 



In particular for a key-distillable PPT state gn with 
Ai = Ai where Ai is given by (|2~T|) the tolerable noise for 
the Devetak- Winter protocol with the recurrence prepro- 
cessing (f3"6")) is approximately equal to 0.155 while for the 
sole Devetak- Winter protocol it is approximately equal 
to 0.005, i.e., it is 31 times smaller. See hgure[5] 



E. Separability 

Given a state gu of the class C with X given by © 
and d = 2, i.e., g is a state of 4 (g) 4 system, we may try 
to decompose g into a mixture of four two qubit states. 
The particular decomposition, which we propose below, 
is possible if 



|a 3 -a 4 | < (i-Ai-A 2 )pr r || 

or equivalently if 



(38) 
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Ai + A 2 



Qij = 



_(Ai - A 2 )e 



-i4>i 



A3 + A4 

(A 3 -A 4 )||X r |r 



(A3-A 4 )||X 1 ||- 
A3 + A4 



(Ai - A 2 )e'*«" 



Ai + A 2 



(39) 



FIG. 3: The form of two qubit Bell diagonal states from decomposition of a state gu with d — 2. 



< \\X L 



(40) 



All of the four two qubit states in our decomposition 
are Bell diagonal states with the same set of eigenvalues. 
Thus, the two qubit states are separable (and, hence, 
g is separable) if all their eigenvalues are less than or 
equal to g |32| . For our decomposition this happens if, 
additionally to (138p , the following conditions are satisfied 



Ai < 
A 2 < 



|A 3 -A 4 | < (A 1 + A 2 )||X r || 



(41) 

(42) 
(43) 



or equivalently, additionally to (|4"0"]l . the following condi- 
tions are satisfied 



a < 



< 



P 
P 

l-p> 



(44) 
(45) 



Note that conditions (|4"3")) and (|45l) are identical to the 
PPT conditions for g given by (|2"3"|) and (|2l5"|) , respectively. 

The decomposition into the four two qubit states has 
the form 



\u o 



l'i = -^eoo(|00) aa,, \1Q)aa-\ |00) flB /, |10)bb0 
Qoi(\00)aa>, \U)aa'\ \01)bb>, \W)bb>) 
Qio{\Q1)aa>, |10)aa'5 \00)bb', \ll) bb>) 
qu{\01)aa', aa>; |01)bb', |H)bbO (46) 



+ 



u 

Ki 

u 

WlO 



u 



where Uij are the elements of the unitary matrix on C 2 
used to define operator X in (JHJ) , u is given by (pTJj) , and 
denote the two qubit states given by (|3"9)) on figure [3] 
where (/>y comes from the polar decomposition of «y 



\ Uij \e^. 



(47) 



The local basis of Alice and Bob for each of the two 
qubit states are given in (|46D in parenthesis. 



F. PPT key arbitrary close to separability 

One can obtain key from some 4 <E> 4 PPT states ly- 
ing arbitrary close to the set of separable states. That 




0.586 





2 


P Pmax 


~ 3 


«=ll* r | 


1 




P = l 





FIG. 4: A class of key-distillable PPT entangled states: (a) 
the solid line from q on the boundary of the PPT entan- 
gled states (inclusive) to the boundary of the set of separable 
states, arbitrary close to £> scp ; (b) the arc of PPT- invariant 
states starting in g and approaching arbitrary close to (5 max . 



is, one can easily select a single parameter subclass of 
the class C satisfying PPT conditions and approaching 
some separable state with p = \ such that for any other 
state in this class, no matter how close to the separable 
state, the key condition (|3"3")) is satisfied. Note that if 
we chose a separable state with p 7^ i as the final state 
the key condition would be violated before reaching that 
final state; thus, we would not approach with the key- 
distillable states arbitrary close to the set of separable 
states. 

Such a class of states, a subclass of qh, is illustrated 
in figure SI The dashed line represents the subclass qh, 
given by (I2ip . a mixture of two pbits (7^ and 7^) which 
in alternate parametrization is equivalent to p G [0, 1] and 
a = /3 = 1. As shown in [l|, this class contains exactly 
one (boundary) PPT entangled state obtained by setting 
p = X% where Ai is given by (|2"T|) , otherwise the states 
are NPT. 

The solid line represents a class of PPT key-distillable 
states obtained by setting p £ (|,p m ax)i & — min(l, a%), 
and /3 = min(l, o^ 1 ), where p max = (1 + \\X r \\ 2 )- 1 = §, 



7 



see observation [TJ while ol\ is given by (j2"B")) , i.e., ol\ — 
1^2- y/2 in the considered case. In the range p € (|,Ai] 
the class is represented as a straight line from the PPT 
state of the previous class qh on one end (p = Ai) and 
approaches arbitrary close to the separable state g scp 
(p = \) on the other end. In the range p £ [Ai,p max ) 
the states are PPT-invariant and lie on the boundary 
of PPT entangled states, they are represented as an arc 
from the PPT state of the previous class qh on one end 
(p = Ai) and approach arbitrary close to the state £> max 
(p = Pmax) on the other end. In the range p £ (Ai,p max ) 
one could take a < ai, such that the key condition (j3"3")) 
is still satisfied, to enter inside the class of PPT states. 



IV. STATES g H AS MIXTURES OF BELL 
STATES WITH 'FLAGS' 



A. For states of the class qu 

Here, we find the supremum of the von Neumann en- 
tropy of the subclass gjj of the class C with X given by © 
consisting of states that are both PPT and key-distillable 
by corollary [TJ Let as denote this set of states as VlCd, 
subscripted with the dimension of the unitary used to 
define operator X. 

As g is a mixture of four orthogonal private bits its 
von Neumann entropy is given by 



S(g u )=H(p)+p(H 



where 



1 - a 



■ S(VxTx) ) 



+ (l-p)(V(i y ^+S(x/Fty)) (55) 



States of the class gn are separable in the AB : A'B' 
cut, i.e., subsystems AB and A'B' of gn are are only 
classically correlated. A state from gn can be decom- 
posed into a mixture of four states. Each of the four 
states has a Bell state ip* on the subsystem AB and some 
corresponding state on A'B' . 

One can select parameters p £ [0, 1], a £ [—1, 1], and 
13 £ [-1,1] satisfying both the PPT conditions flH|) and 
and the key condition ([551) . and prepare a corre- 
sponding PPT key-distillable state from the class gn 
which has the form 



Qh = 53 ft IV'iXV'iUs ® Qa'B' 



(48) 



where the Bell states tpi are given by (j2"0)) and the corre- 
lated states are the following: 



Q 



(1) 



a- (Poo 



P 



i>i.i 



g^ = a l -{ Pll + P^) + (1 - a) 1 - 



n(3,4) _ 



(49) 
(50) 
(51) 



where P^, denotes the projector onto a pure state ip and 
1 



X± 



V2±\/2 
P 



(100) ± 



91=92=2 



93 = 94 = 



1-p 



(52) 

(53) 
(54) 



V. MAXIMIZING VON NEUMANN ENTROPY 



S(VXTX) < 21og 2 d 



log 2 , 



(56) 
(57) 



and the maximal value in (|56[) is achieved if the unitary 
used to define X in @ is unimodular. A unimodular 
unitary also maximizes the allowed range of p given by 
observation [TJ as it achieves minimum of ||A' r ||. Hence, 
to maximize the entropy, it is enough to consider a uni- 
modular unitary. The supremum is achieved for a state 

with p = p max , /3 — 0, and a = \J (which no longer 

satisfies our key-distillability condition) thus 



sup S{q v )= sup (1 +p)\og 2 d+ (1 -p) 



H{p)+pH 




(58) 



where p max = (1 + ||X r || 2 ) -1 comes from observation [TJ 
In particular, for d — 2, i.e., g being 4 <8> 4 states, the 
supremum is achieved for state having p = p max = 2/3 
which gives 



sup S(gu) w 3.319. 



(59) 



The supremum corresponds to a state p max on figure 0] 
but with f3 = 0. 



B. For states of a class larger than qu 

For the subclass g of the class C with d — 2 and X and 
Y given by (|12p . we are able to obtain 



S{g) ks 3.524 



(60) 



In this section, we find 4 <g> 4 key-distillable PPT states 
with a quite high von Neumann entropy for two sub- 
classes of the class C and summarize the results in a ta- 
ble. 



for Ui = U-2 = H , q R3 0.683, (3 — and a, p taken as in 
the previous subsection. It seems to be the supremum of 
the von Neumann entropy for this selection of operators 
X and Y. 



s 



C. Summary 

Here, we summarize the results of maximizing von 
Neumann entropy of 4 <g> 4 key-distillable PPT states in 
the following table: 

S(g) g satisfying PPT and key conditions 

2.564 class g from [lj with p = Ai, the maximum is 

achieved for U = H 
3.319 class gu, the supremum is described in Sec. IV AI 
3.524 class C with Y given by (fT2"]l . a supposed supre- 
mum is described in Sec. IV Bl 



s(qbb') = i + \s B (pVxxt + (1 - P )\/Ft7) 

+ ^S B (pVX^X + (1 - p)vWt) . (63) 



VII. 



CONDITION FOR DRAWING SECURE 
KEY FROM GENERAL STATES 



From Sec. lIII Cl we have a sufficient condition for draw- 
ing key in terms of norms of the nonzero blocks from 
states having a Bell diagonal privacy-squeezed state. In 
this section, we generalize that condition to the case of 
an arbitrary state. 

Let us define two twirling operations (cf. [23]) 



VI. DISTILL ABILITY VIA ERASURE 
CHANNEL 

In (l9| . it was shown that two zero capacity chan- 
nels, if combined together, can have nonzero capacity. 
One of the channels was related (through so called Choi- 
Jamiolkowski (CJ) isomorphism) to a bound entangled 
but key-distillable state, while the other was a so called 
symmetrically extendable channel. In particular, they 
considered an example, where the first channel had 4(g) 4 
CJ state from the class (|21l) while the second one was 
the 50%-erasure channel. In [25j a simpler scheme was 
proposed, which also allows to observe this curious phe- 
nomenon. 

The second approach amounts to sending a subsystem 
A' of a state defined on systems ABA' B' through the 
50%-erasure channel and checking the coherent informa- 
tion of the resulting state. If it is positive one concludes 
that the capacity of combined channel is also positive. 
Here, we shall use this approach to see how the presence 
of coherence j3 influence the phenomenon. 

Coherent information after sending the A' subsystem 
through the 50%-erasure channel is given by 

Foh = -^{Sa'bb' — S) + -{Sbb> - Sabb 1 ) (61) 

where S, Sa'BB', and Sbb 1 are given by (f51)|) . (|6"2"|) . and 
(|6"3")l . respectively. 

For a PPT state g given by (gJJ) with X given by @ 
and based on unimodular unitary and Ai = Ai, where 
Ai is given by (|27p . the coherent information is positive 
starting from d = 11. For a similar state of our class 
with p = Ai, a = 1 and j3 = the coherent information 
is positive starting from d = 22. 

Formulas for Sa'BB' and Sbb' are as follows: 

S(qa'bb> ) = i + \s (p^XXl + (1 - pjvTty) 

+ -S (pVxVC + (1 - p)vWt) (62) 



Azz 



I + X®X) 

i + z®z) 



(64) 
(65) 



and one twirling with flags 



1 



AWf?) = 2(0® I°><°1 + x ® x (e) ® Ii><i|) ( 66 ) 

where Ug = U qU\ X and Z are Pauli matrices. 

Now, we give a sufficient condition to obtain key from 
a general state. 

Proposition 2. For an arbitrary state 



'A BCD 

St E F G 
Ct Ft H I 



(67) 



if 



max(||D||,||F|: 



+ ||J||)(||F|| + ||F||) (68) 



then Alice and Bob can distill cryptographic key by first 
applying twirling A' xx o Azz to the key part and measur- 
ing the key part of many copies of the state g and than 
using the recurrence and the Devetak- Winter protocol. 

Remark 3. Note that the right-hand side of Eg. (f6"8")) can 

also be written as \ y/p e (l — p e ) where p e is the probabil- 
ity of error (i.e. anticorrelation) when key part is mea- 
sured in standard basis. 

Proof of the proposition [JJ Alice and Bob first apply 
twirling A' xx o Azz (an LOCC operation) to the key 
part and obtain the following state 



A' xx oA Z z(g) 



A® J 



E®H Fi 
FffiFt E>. 



Ft 



A® J 



(69) 
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This state is now of the spider form and, thanks to flags, 
we have direct sums within the blocks. Now, the privacy- 
squeezed state has the following Bell diagonal form 



\A\\ + \\J\\ 



\\E\\ + 
\F\\ + \ 



\F\\ + \\F'\ 
\\E\\ + \\H\\ 



\D\\ 



\D 



\D\\ + \\& 



\A\\ + \\J\\ 



Then the proof follows from proposition [T] 



(70) 
□ 



Note that in the proof above we use A' xx , a twirling 
with flags. If KxXi a twirling without flags, were used 
instead we would have to replace ||D|| with ||D + D'\\ in 
(JHHJ) (analogously for \\F\\) which can be much smaller 
than \\D\\, and even equal to zero in the extreme case of 
antihermitian D, i.e., = —D, so in this case no key 
can be distilled from Axx(ff) even if g is a private state, 
i.e., g = 7(D). 

Note also, that in the proof, we have first applied 
twirling with flags to the original state, and then the 
privacy-squeezing operation. Actually, the same state 
would be obtained if we first apply the privacy squeezing 
and then apply (standard) twirling. This is illustrated 
by the following diagram 



where P sq stands for the privacy squeezing. As explained 
above, this diagram would not commute if we used solely 
twirling without flags. Thus, to seek for key-distillable 
states, one can go the alternative route, i.e., first compute 
the privacy-squeezed state, and then, by twirling, obtain 
a Bell diagonal state. Now, if Axx ° Azz{&) satisfies 
necessary security condition for realistic QKD on a Pauli 
channel from i.e., its eigenvalues A^ satisfy (j32), then 
g is key-distillable using proposition [5] 



VIII. APPENDIX 



The parametrization of a single qubit unitary [2 



U = e l 



») cos (^) 
)sin(i) 



«*(-#+*) 



<#+!) 



sin (2) 
cos (2) 



(72) 
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A' xx oA zz 

g ► q[ 



a 
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